At July 21, 2014 the version 2.0.0 has been released. Here was a quick overview over the features and changes made in the last time to release this major revision.

Tobago 2.0.0 contains 184 entries in . and most of them are exclusive in this version.

Please take also a look at the guide.

Date- and Time-Picker

- Using jQuery UI Datepicker and TimePicker Addon
- Faster — no server request
- Better interactivity
- Old Date-/TimePicker via `tobago-config.xml`

Draggable Popups

Input Suggest

- New implementation
- Sub-Tag `<tc:suggest>`
- More configuration options

Tabs

- Icons
- Toolbar buttons

File upload

- Looks pretty now in every browser

Radio Buttons

- Icons

HTML WYSIWYG Editor

- Integration example in the demo of and
- Not included, because of incompatible licences or breaks CSP
- Other possible, but many have disadvantages

Default Command for Sub-Forms

- Dependent from the focused input, the default command will be selected
- Markup to show the command to the user

Tree and Tree-Table

- Big internal refactoring
- Work internally now with the JSF `UIData`
- Free model: `DefaultMutableTreeNode` is not required any longer, but you can implement `javax.faces.model.DataModel`
- TreeTable
- Infinite Trees possible
- Selectors: sub-tree selection

More

- Dynamic lists in `<f:selectItems>` need not glue code (JSF 2.0)
- Redirect in navigation rules doesn't break layout size
- Additional possibility to show paging arrows in sheet
- Automatically create accesskey from underscore is know configurable

Content Security Policy

- To prevent XSS
- Idea:
  - Don't execute any code inside the HTML file
    - No content in script tags
    - no onclick, nor on* etc.
  - Don't execute `eval(script)`
  - Don't apply CSS inside the HTML file
  - Define the sources of any resources
  - Strict separation of code and data
    - Keep the code in JavaScript Files
    - Put additional data in HTML5 `data-*` attributes
- Browser support: all current, but IE 10 and 11 only "sandbox"
- Activated by default, can be configured via `tobago-config.xml`
- There is also a "report-only" mode for development

Content Security Policy and Tobago

- All renderers and scripts are refactored to be compliant with CSP
- Using application specific JavaScript in Tobago
  - script attribute in command tags is deprecated
  - Problem: when setting non of these attributes: `action`, `script`, `link`, Tobago will create a default action. This can't be changed without breaking compatibility.
  - Solution: `omit="true"`

Sanitize potentially malicious content (to prevent XSS)

- `<tc:textarea>`, when it contains a `<tc:dataAttribute>` with `name="html-editor"`
- `<tc:out>`, when `escape="false"`
- Default implementation: whitelist scanning
- Configurable via `tobago-config.xml`
- Why? See

More

- Setting nosniff HTTP header (to prevent XSS)
- Don't allow to be in a frame (to prevent Frame-Attacks)
- Both are configurable via `tobago-config.xml`, default is secure

- Tree uses subclass of `javax.faces.model.DataModel`
- Using Java APT generator
- Using ' instead of " for HTML attributes (JSON friendly)
- JavaScript logging via console (plus workaround for old browsers)
- The `theme-config.xml` was merged with `tobago-config.xml`
- Access the Tobago configuration via the `TobagoContext`
- The `TobagoConfig` is immutable after initialization
- Add the version of Tobago into the resource URLs to avoid caching problem after updates